CVE-2026-68156 | In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cached values are then used by the messenger connect code when sending the authorizer. ceph_x_update_authorizer() can rebuild the authorizer when a newer service ticket is available. If the rebuilt autho
In the Linux kernel, the following vulnerability has been resolved:
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
ceph_x_create_authorizer() caches au->buf->vec.iov_base and
au->buf->vec.iov_len in struct ceph_auth_handshake. These
cached values are then used by the messenger connect code when
sending the authorizer.
ceph_x_update_authorizer() can rebuild the authorizer when a newer
service ticket is available. If the rebuilt authorizer no longer
fits in the existing buffer, ceph_x_build_authorizer() drops its
reference to au->buf and allocates a new one. If this is the final
reference, ceph_buffer_put() frees the old ceph_buffer and its
vec.iov_base, but auth->authorizer_buf still points at that freed
memory.
A subsequent msgr1 reconnect can therefore queue the stale pointer
and trigger a KASAN slab-use-after-free in _copy_from_iter() while
tcp_sendmsg() copies the authorizer.
Refresh auth->authorizer_buf and auth->authorizer_buf_len after a
successful authorizer rebuild so the messenger sends the current
buffer.
- 🔗 git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c…
- 🔗 git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589…
- 🔗 git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4…
- 🔗 git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723…
- 🔗 git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a0…
- 🔗 git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433…
- 🔗 git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461da…
- 🔗 git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcec…
```Code``` unterstützt. Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-09-23 | 2026-10-07 |
|---|---|---|
| ≥90 % | 491 | 344 |
| ≥50 % | 1475 | 1071 |
| ≥10 % | 0 | 3 |
| <10 % | 0 | 549 |
CVE-2026-68156 | In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cached values are then used by the messenger connect code when sending the authorizer. ceph_x_update_authorizer() can rebuild the authorizer when a newer service ticket is available. If the rebuilt autho
In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_
Noch keine Analyse zu CVE-2026-68156
Sei der Erste: Einschätzung, Betroffenheit, Workaround oder PoC — mit Antworten im Thread.